Hacker News Reader

Comment by tmikaeld | Hacker News Reader

On MacOS, the free "RansomWhere?" tool is a really nice thing to have, it warns if any app is hammering files and stops it until you approve/deny.

https://www.objective-see.com/products/ransomwhere.html

View on HN

Windows 10 now has in-built randsomware protection with Windows Defender.

Does it actually work? I haven't had a virus in decades to my knowledge, and I stopped running virus scanners back in 2005 or so. Windows Defender is on my computer, but I never run a scan. Maybe it does in the background, but I've never seen anything notifying me about a virus or ransomware or malware.

Windows Defender does background scanning unless you disable it (and Windows will show a nice warning icon in the tray if you do).

and if you disable it it turns itself back on, it even says "i wont stay off for long"

You can disable it permanently, but I believe it requires registry editing to do so. I run Win 10 with real-time protection always turned off.

Not sure about the registry, but it's definitely something you can disable in Group Policy (though Group Policy is only available on Windows 10 editions greater than Home).

I think you're right and I misremembered how I did it, since it had been so long. Thanks for the correction!

I believe Win10 recently added (or is adding) something equivalent to directory-level permissions, so that you can mark applications unable to touch certain directories (like My Documents) unless they've been whitelisted.

It's their ransomware protection. The last time I tried it months ago, it was really aggressive to the point that it made it uncomfortable to work with my computer. Maybe that's necessary to keep people safe, but I had to disable it because basic things like downloading files and opening them with another program simply didn't work. Maybe it's improved since then?

The same thing happened with the introduction of UAC.It may be necessary though it conditions people to blindly allow as their default reaction, which is really counter-productive to safety.

It actually doesn't provide a prompt. It silently denies access (I think maybe it shows a notification in the bottom right?) and that's that. You have to navigate to the protection settings window in order to whitelist a program. Which I guess makes sense, since if you don't add friction, people will just blindly allow everything as you say. I had problems like stuff not working despite whitelisting, which is what really annoyed me. I would've left it on otherwise.

The short answer is sometimes yes, sometimes no, like with a lot of software. It's not universal protection.

For example, there if someone mails you an attachment that you open, there is a program that can find your dropbox and encrypt all your files....including on your local machine (whatever filesystem elements are linked to dropbox) and drop new virus vectors on your dropbox directories. Windows Defender didn't notice when it happened in our office.

Of course you just revert your file folders in Dropbox (machines that are also linked to that dropbox that aren't the original vector, which should be quarantined) and lose all the work since the last synchronization, but you aren't dead in the water.

It told me a driver I downloaded for my Razer had a virus. I have no idea if it did or didn't. I do know that Razer's website for driver downloads is http not https

¯\_(ツ)_/¯

http://drivers.razersupport.com//index.php?_m=downloads&_a=v...

I have processing program I wrote that runs though hundred of thousand html-files on a Windows machine monthly and it is really slow unless I turn off defender, so I assume it's checking what my program does somehow.

You can turn off (preferably temporarily) the windows defender real-time protection (that's the setting name). That speeds up such things. That setting will after a while reset to the default (on) by itself.

Also note that Windows is pretty slow on such operations, opening and reading of lots of files (eg a build). It may actually be quicker to set up a virtual machine running Linux for such a thing.

Have you tried whitelisting your program in defender?

No, good idea I will try it.

Every now and again I see a '0 viruses found since last scan' message in the notification tray. Maybe check and see if there is anything like that in yours?

Second this. The only annoying thing about it is the number of false positives. When I leave a large build running overnight, it randomly triggers the check and halts the entire build.

Sounds like a scenario easily foreseen since a build should work on lots of files... Can't you whitelist the binaries involved?

I am going to start using this immediately, thank you.

I have long wondered why precisely this isn't built into all the major OS's.

Edit: Although, reading more, I'm not sure I love how the logic works. For instance, it ignores all Apple apps. I understand the logic behind that, but there should be different thresholds: If any process on my machine, Apple or not, rewrites 10GB or more (to choose a somewhat arbitrary amount), I want to know about it ASAP. Otherwise, what if the ransomware finds a way to leverage Apple processes?

There's no need to monitor Apples own processes because MacOS already do that with "System Integrity Protection" which stops any modification of system files.

See here: https://support.apple.com/en-us/HT204899

I have SIP turned off. More importantly, I don’t necessarily trust it—someone could find a flaw.

Reply on news.ycombinator.com